Data structure for policy-based remediation selection

• US 20060053476A1
• Filed: 09/03/2004
• Published: 03/09/2006
• Est. Priority Date: 09/03/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Ojha, Sachchida Nand, Immordino, John Leonard, Ogura, James Le, Bezilla, Daniel Bailey
• Granted Patent: US 7,761,920 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A machine-actionable memory may include: one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID); and at least one POL_ID field, the contents of which denotes an ID of at least one policy (POL_ID), the at-least-one policy respectively defining a condition satisfaction of which is potentially indicative of unauthorized activity or manipulation of the device.

Claims

1. A machine-actionable memory comprising:

one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between

at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID); and

at least one POL_ID field, the contents of which denotes an ID of at least one policy (POL_ID), the at-least-one policy respectively defining a condition satisfaction of which is potentially indicative of unauthorized activity or manipulation of the device.

2. The memory of claim 1, wherein the data structure further includes:

one or more parameter fields, the contents of which denote present and one or more previous values of one or more parameters associated with the at-least-one policy.

3. The memory of claim 1, wherein the data structure further includes:

at least one ACT_ID field, the contents of which denotes an ID of an action (ACT_ID).

4. The memory of claim 1, wherein:

excursion of one or more parameter values outside of the boundaries of the at least one policy denoted by the at least one POL_ID field may be cause for invoking the remediation; and

execution of the at least one action denoted by the contents of the at least one ACT_ID field at least in part implements the remediation.

5. The memory of claim 1, wherein the data structure further includes:

at least one CE_ID field, the contents of which denotes an ID of an asset (CE_ID) to which the remediation is to be applied.

6. The memory of claim 5, wherein:

excursion of one or more parameter values outside of the boundaries of the at least one policy denoted by the at least one POL_ID field may be cause for invoking the remediation;

execution of the at least one action denoted by the contents of the at least one ACT_ID field at least in part implements the remediation; and

implementation of the remediation upon the at least one asset denoted by the contents of the at least one CE_ID field mitigates against a future excursion of the one or more parameter values outside the boundaries of the at least one policy.

7. The memory of claim 5, wherein the data structure for at least one of the one-or-more machine-actionable records includes:

two or more POL_ID fields, the contents of which denote two or more POL_IDs, respectively;

a plurality of ACT_ID fields, the contents of which denote a plurality of ACT_IDs, respectively;

two or more SS links relating one or more among the plurality of ACT_ID fields as a subset (SS) thereof, respectively;

two or more CE_ID fields, the contents of which denote two or more CE_ID fields; and

at least one of the following,

(A) at least two P-SS links between the two or more POL_ID fields, respectively, and the two or more subsets,

(B) at least two R-P links between the at-least-one R_ID field and the two or more POL_ID fields, respectively,

(C) at least two R-SS links between the at-least-one R_ID field and the two or more subsets, respectively, and

(D) at least two R-AS links between the at-least-one R_ID field and the two or more CE_ID fields, respectively.

8. The memory of claim 1, wherein the data structure for at least one of the one-or-more machine-actionable records includes:

two or more POL_ID fields, the contents of which denote two or more POL_IDs, respectively;

a plurality of ACT_ID fields, the contents of which denote a plurality of ACT_IDs, respectively;

at least two SS links relating one or more among the plurality of ACT_ID fields as a subset (SS) thereof, respectively; and

at least one of the following,

(A) at least two P-SS links between the two or more POL_ID fields, respectively, and the two or more subsets,

(B) at least two R-P links between the at-least-one R_ID field and the two or more POL_ID fields, respectively,

(C) at least two R-SS links between the at-least-one R_ID field and the two or more subsets, respectively.

10. A machine having a memory as in claim 1.

11. A machine having a memory as in claim 2.

12. A machine having a memory as in claim 3.

13. A machine having a memory as in claim 4.

14. A machine having a memory as in claim 5.

15. A machine having a memory as in claim 6.

16. A machine having a memory as in claim 7.

17. A machine having a memory as in claim 8.

9. A method of selecting a remediation that is appropriate to a policy for a device that includes a processor, the method comprising:

providing a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between

at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID), and

at least one POL_ID field, the contents of which denotes an ID of a policy (POL_ID), the policy defining a condition satisfaction of which is potentially indicative of unauthorized activity or manipulation of the device; and

indexing into the memory using a given POL_ID value to determine values of the at-least-one R_ID corresponding thereto.

19. A machine configured to implement the method of claim 9.

18. A machine-readable medium comprising instructions, execution of which by a machine selects a remediation that is appropriate to a policy for a device that includes a processor, the method comprising:

a first code segment to provide a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between

at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID), and

at least one POL_ID field, the contents of which denotes an ID of a policy (POL_ID), the policy defining a condition satisfaction of which is potentially indicative of unauthorized activity or manipulation of the device; and

a second code segment to index into the memory using a given POL_ID value to determine values of the at-least-one R_ID corresponding thereto.

20. An apparatus for selecting a remediation that is appropriate to a technology present on a machine to be remediated, the method comprising:

a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between

at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID), and

at least one POL_ID field, the contents of which denotes an ID of a policy (POL_ID), the policy defining a condition satisfaction of which is potentially indicative of unauthorized activity or manipulation of the device; and

means for indexing into the memory using a given POL_ID value to determine values of the at-least-one R_ID corresponding thereto.